"Secret scanning and credential detection tools" matching MCP tools:

• update_credentialA

  EchoRelayA

  Rename a credential and/or rotate its secret, publishing the change immediately so every target that uses this credential picks it up right away. Omit a secret field (or the whole `auth` object) to keep the existing value — the vault can never show a secret back to confirm it, so leaving it out means "unchanged," not "cleared." The destination host cannot be changed here: create a new credential for a new destination.

  Connector

  Destructive

  No auth

• code_searchA

  searchcodeA

  Fast code search across any public git repo. Returns file paths, line numbers, and code snippets with context. Supports regex, boolean queries, fuzzy matching, and structural filters (declarations, usages, strings, comments). Dependency/build directories excluded by default. Searching for leaked secrets? Call code_analyze instead and read security_summary — it runs a real secret and credential scanner over the whole repository, where searching for key prefixes like "sk-", "ghp_" or "AIza" only matches the spellings you happened to think of.

  ConnectorNo auth

• setup_local_cryptoA

  seekrit — secrets for agentsA

  Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-paste .mcp.json that reuses this session's credential. Takes no arguments and returns prose plus config. Call this the moment you need to SET or READ a secret value — no tool on this server will ever return one. Use local_tool_for instead when you want the single command for one named operation.

  ConnectorNo auth

• accept_termsA

  Hashlock MarketsA

  Accept the current terms at the price you read (currentQuoteAmount from get_thread) — refused if it moved since. Needed only when your side's accepted flag (takerAccepted / makerAccepted) is false: your own quote, or a proposal you sent with your hashlock as the initiator, already counts. When BOTH sides have accepted, the HTLC swap is created. The initiator (funds the long leg) must pass hashlock = sha256(secret): generate a 32-byte secret yourself, keep it safe, and reveal it only when you claim. The server never sees your preimage.

  ConnectorAPI key

• webhooks_manageA

  gapup-mcpC

  Manage HTTP webhook callbacks for async tools (T5/T6 batch flagships). Instead of polling every 5s, register a callback URL — Gapup posts the job result to your endpoint the moment it completes. Supported events: job.completed | job.failed | monitoring.alert | quota.threshold. Modes: register (add endpoint), list (view active webhooks), revoke (soft-delete), test (fire a test payload to verify your receiver), history (last 20 fires). Security: every delivery is signed with HMAC-SHA256 on the body — verify the X-Gapup-Signature header against sha256(secret, body).

  ConnectorNo auth

• webhooks_manageA

  mcp-knowledgeC

  Manage HTTP webhook callbacks for async tools (T5/T6 batch flagships). Instead of polling every 5s, register a callback URL — Gapup posts the job result to your endpoint the moment it completes. Supported events: job.completed | job.failed | monitoring.alert | quota.threshold. Modes: register (add endpoint), list (view active webhooks), revoke (soft-delete), test (fire a test payload to verify your receiver), history (last 20 fires). Security: every delivery is signed with HMAC-SHA256 on the body — verify the X-Gapup-Signature header against sha256(secret, body).

  ConnectorNo auth

• webhooks_manageA

  gapup-mcpC

  Manage HTTP webhook callbacks for async tools (T5/T6 batch flagships). Instead of polling every 5s, register a callback URL — Gapup posts the job result to your endpoint the moment it completes. Supported events: job.completed | job.failed | monitoring.alert | quota.threshold. Modes: register (add endpoint), list (view active webhooks), revoke (soft-delete), test (fire a test payload to verify your receiver), history (last 20 fires). Security: every delivery is signed with HMAC-SHA256 on the body — verify the X-Gapup-Signature header against sha256(secret, body).

  ConnectorNo auth

• send_replyA

  DeskCrew - AI Chatbot, Helpdesk & Knowledge baseA

  Sends a reply to the customer on an existing ticket and DELIVERS it immediately (customer email plus any connected chat threads). This is not a draft and it reaches the customer. Use this once you have a final, customer-ready answer; to instead queue a reply for human approval, use the draft tool. Requires a "send"-tier credential (a draft-tier credential is refused) and the ticket must already have a customer email on file or the call is rejected. [$0.06 draft / live when trusted]

  ConnectorNo auth

• invoke_mtprotoA

  Fast MCP TelegramA

  Low-level Telegram API (MTProto) invoke for methods not wrapped by other tools. Dangerous methods require allow_dangerous=true. Success: API result dict or normalized error. PII and credential-shaped fields (phone, access_hash) are dropped from a successful result by default; pass include_sensitive=true for the raw payload. A bare message id needs a chat binding: requests with no peer field (messages.GetMessages, messages.DeleteMessages) are refused, because a bare id resolves against an arbitrary dialog. Use channels.GetMessages or messages.GetHistory, which carry the binding. messages.GetHistory cannot address a forum topic (no thread_id/top_msg_id in the schema, and channels.GetHistory does not exist) -- use messages.Search with top_msg_id, or the high-level get_messages with reply_to_id. Full documentation: https://github.com/leshchenko1979/fast-mcp-telegram/blob/main/docs/Tools-Reference.md

  Connector

  Destructive

  No auth

• invoke_mtprotoA

  fast-mcp-telegramA

  Low-level Telegram API (MTProto) invoke for methods not wrapped by other tools. Dangerous methods require allow_dangerous=true. Success: API result dict or normalized error. PII and credential-shaped fields (phone, access_hash) are dropped from a successful result by default; pass include_sensitive=true for the raw payload. A bare message id needs a chat binding: requests with no peer field (messages.GetMessages, messages.DeleteMessages) are refused, because a bare id resolves against an arbitrary dialog. Use channels.GetMessages or messages.GetHistory, which carry the binding. messages.GetHistory cannot address a forum topic (no thread_id/top_msg_id in the schema, and channels.GetHistory does not exist) -- use messages.Search with top_msg_id, or the high-level get_messages with reply_to_id. Full documentation: https://github.com/leshchenko1979/fast-mcp-telegram/blob/main/docs/Tools-Reference.md

  Connector

  Destructive

  No auth

• call_toolA

  RelaystationA

  Run a tool found via search_tools by name, passing its arguments. Dispatches the safe/billable utility tools (the cputools catalog + free reads/quotes) through the identical auth + billing + validation as a direct call. Consequential tools (account, money, credential, messaging — e.g. create_topup_link, create_baton, mint_token, ask_operator) are NOT dispatchable here: call them directly by name so your client can gate them with per-tool consent. FREE to invoke (the wrapped tool bills itself). Example: call_tool {name:"pdf_merge", arguments:{files:[{inputKey:"<key1>"},{inputKey:"<key2>"}]}}

  ConnectorNo auth

• cve_lookup_toolA

  HoneyLabsA

  Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily timeline. Use whenever the user names a CVE: "is CVE-2024-4577 being exploited in the wild", "who scans for CVE-2023-1389", "has anyone probed this before it was published". Do not pass a CVE id to payload_search_tool: the id is our label for a detection pattern and never appears in request text. For the list of CVEs being probed right now, use top_attackers_tool with by='cve'. Returns title, severity, actively_exploited and kev (the CISA KEV entry with date_added, or null), event and unique-address counts across both sensor types (first_contact_events and interactive_requests split them; an address both saw counts once), up to `limit` top probing addresses (1 to 25, default 25) with country, ASN and scanner (name and kind of a recognised research or vendor scanner, else null), top networks and countries, exploiter fingerprints, sample paths, a daily timeline and `interactive` (what the interactive sensors recorded of the probes). window: 24h, 7d (default), 30d or 90d, and on plans with the full history also 180d, 365d or all. observed: false with a note means we hold no detection pattern for that CVE, which is not evidence that nobody is scanning for it.

  ConnectorNo auth

• register_serverA

  PayGate MCPA

  Start charging for an MCP server the user owns. Use when they want to monetize, sell, charge for, get paid for, put a price on, or make money from a server, API or tool. Buyers pay their wallet DIRECTLY on-chain — PayGate never holds the money, so there is no payout to wait for, no balance to withdraw and no commission taken. Their server is never modified and needs no payment code. Tools are imported automatically, so it must be publicly reachable over HTTPS and answer tools/list. Returns a proxy URL and a secret api_key shown only once; save it, every other seller tool needs it.

  ConnectorNo auth

• register_serverA

  PayGate MCP — Monetization Gateway for AI AgentsA

  Start charging for an MCP server the user owns. Use when they want to monetize, sell, charge for, get paid for, put a price on, or make money from a server, API or tool. Buyers pay their wallet DIRECTLY on-chain — PayGate never holds the money, so there is no payout to wait for, no balance to withdraw and no commission taken. Their server is never modified and needs no payment code. Tools are imported automatically, so it must be publicly reachable over HTTPS and answer tools/list. Returns a proxy URL and a secret api_key shown only once; save it, every other seller tool needs it.

  ConnectorNo auth

• mpp_upgradeA

  NovenceA

  Start or complete Pro/Scale via Machine Payments Protocol. Requires nv_ + verified email. First call returns a 402 Payment challenge; retry with payment_authorization (Payment credential) or _meta org.paymentauth/credential. Use after a 2nd project or a 402 — never after the first live URL.

  ConnectorNo auth

• create_checkout_linkA

  Ada DiamondsA

  Assemble a cart and get a Stripe-hosted checkout URL the customer opens to pay; no card data passes through the agent. Item ids come from the search tools (`diamond:<report>`, `setting:<slug>`, `jewelry:<slug>`); a complete ring is one setting plus one diamond. Needs the shipping address (prices tax and shipping into the link). Expires after 24 hours. No credential needed. Without a production credential this tool runs in the sandbox: the link is simulated and no Stripe session is created. Pass `env: "production"` when the customer actually wants to buy — that returns a live, payable link.

  ConnectorNo auth

• get_meA

  Extend MCPA

  Return the connected organization, the credential in use, and the granted workspace + environment ("TEST" or "PRODUCTION") targets — exactly the values the required workspaceId/environment arguments on targeted tools accept. Always available; call this first, and again whenever a tool returns UNAUTHORIZED or NOT_FOUND unexpectedly, or after this connection's access changes — resources live per-workspace.

  ConnectorOAuth

• uptime_monitorA

  MockbirdA

  Free downtime alerts for any public URL — no account, armed in one call. action:"create" {url, notify?}: Mockbird GETs the url every 30 minutes from Cloudflare's network (8s timeout, 2xx/3xx = up; a timeout/TLS/DNS blip on an otherwise-up url is confirmed with a same-run retry before it counts); with notify, that webhook gets ONE message when it goes down and ONE when it recovers — debounced (two consecutive checks must agree), so single blips never fire. WITHOUT notify you get a pollable monitor instead — no webhook infrastructure needed. notify formats: hooks.slack.com URLs get {"text"}, discord.com/api/webhooks get {"content"}, anything else gets JSON signed with the returned secret (x-mockbird-signature: sha256=hex(hmac-sha256(secret, body))). The result includes the CURRENT up/down state (checked immediately), a public hostname-only status page /status/:id, an embeddable badge.svg, an Atom feed, and {id, secret} — STORE BOTH; they manage the monitor and cannot be recovered. action:"poll" {id, secret}: (webhook-less monitors) the down/recovered transitions since your last poll plus the latest check — empty events = nothing changed. action:"info" {id, secret}: latest check, 24h ok-rate, recent up/down transitions, alert delivery state. action:"delete" {id, secret}: stop monitoring. Limits: 3 live monitors per IP — deleting one frees the slot immediately (the 429 states the limit); pollable monitors not polled for 30 days are removed. For cron jobs / scheduled tasks use the inverse tool: heartbeat.

  ConnectorNo auth

• heartbeatA

  MockbirdA

  Dead man's switch for cron jobs, scheduled tasks, and recurring agent runs — the INVERSE of uptime_monitor: the JOB pings Mockbird, and if the ping stops arriving the alert fires once (plus one recovery message when pings resume). action:"create" {name?, period_minutes, grace_minutes?, notify?}: period_minutes = how often the job runs (30–10080); grace defaults to half the period. With notify, missed check-ins hit that webhook; WITHOUT notify you get a pollable heartbeat instead — poll for missed-check-in transitions, no webhook needed. Returns a ping URL (curl -fsS -m 10 <ping_url> at the end of the job — or call this tool with action:"ping"), a public status page /status/:id, badge.svg, Atom feed, and {id, secret} — STORE id, secret AND ping_url; they cannot be recovered. Creation counts as the first ping. action:"ping" {ping_url}: check in (use this to arm a heartbeat for YOUR OWN recurring runs — ping each run, and a missed run alerts your human via the webhook or your next poll). action:"poll" {id, secret}: (webhook-less heartbeats) missed-check-in / checked-in-again transitions since your last poll plus the current ping age. action:"info" {id, secret}: last ping, ping URL, recent evaluations. action:"delete" {id, secret}: disarm. notify formats are the same as uptime_monitor (Slack/Discord native, HMAC-signed JSON otherwise). Limits: 5 live heartbeats per IP — deleting one frees the slot immediately; evaluation granularity 30 min; pollable heartbeats with no polls and no pings for 30 days are removed.

  ConnectorNo auth

• watch_service_statusA

  MockbirdA

  Subscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …). action:"subscribe" {service, notify?}: service is an id from check_api_status (or "*" for all tracked services). With notify, that webhook gets one message when the service goes down and one when it recovers (debounced across two consecutive hourly checks — blips never fire; a confirmation message is delivered immediately so you can see the wiring works). WITHOUT notify you get a pollable subscription instead — no webhook needed. Returns {id, secret} — store both. action:"poll" {id, secret}: (webhook-less watches) returns the down/recovered transitions since your last poll — empty events = nothing changed; checks run hourly so polling more often sees nothing new. action:"info" {id, secret}: subscription state. action:"unsubscribe" {id, secret}: stop alerts. notify formats: Slack/Discord webhooks get native payloads; anything else gets HMAC-signed JSON. Limits: 5 live watches per IP — deleting one frees the slot immediately. To watch YOUR OWN URL instead, use uptime_monitor.

  ConnectorNo auth

• account_statusA

  The Bot ForumA

  Reads the account behind the secret: tier, accepted Terms version, the products it may call, the balance in credits the account bought minus the spend those credits funded, the last 30 days of usage per day, product and key, and the 50 latest balance movements. A product's own daily credits are spent before that balance and are no part of it, so a call can be served while it reads zero; list_products carries each product's credit account. Pass the secret sign_up returned as the secret argument; the data key your client configuration sends cannot read the account and answers 403 wrong_credential. Charges nothing; without a string the platform answers 401 invalid_key.

  ConnectorNo auth